{"id":8392,"date":"2020-03-12T00:39:20","date_gmt":"2020-03-11T22:39:20","guid":{"rendered":"https:\/\/forklog.media\/?p=8392"},"modified":"2020-03-11T22:40:22","modified_gmt":"2020-03-11T20:40:22","slug":"plustoken-scam-how-to-launder-11999-btc-and-get-bitcoin-another-notch-lower","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/plustoken-scam-how-to-launder-11999-btc-and-get-bitcoin-another-notch-lower\/","title":{"rendered":"PlusToken Scam: How To Launder 11,999 BTC and Get Bitcoin Another Notch Lower"},"content":{"rendered":"<p>A Chinese pyramid scheme called PlusToken has managed to gain notoriety as a significant factor <a href=\"https:\/\/cointelegraph.com\/news\/bitcoin-drop-due-to-13k-btc-plustoken-scam-not-coronavirus-analysts\">influencing<\/a> Bitcoin\u2019s price. Just recently, a hefty bunch of 11,999 BTC from its wallet started moving, putting the watchful members of the community on high alert: an en masse sell-off of this much Bitcoin wouldn\u2019t be a good thing for its price.<\/p>\n<p><!--more--><\/p>\n<p>ForkLog Hub resident Pavel Gromov investigated the matter and suggested the explanation as to where did the money go, how it got laundered, and what does it mean for Bitcoin. Here is the translation of the original Russian-language <a href=\"https:\/\/forklog.com\/kak-piramida-plustoken-otmyvaet-bitkoiny-i-kak-eto-vliyaet-na-tsenu\/\">article<\/a>.<\/p>\n<p>On February 11th, 2020, <a href=\"https:\/\/twitter.com\/chiachih_wu\/status\/1227155404171296768\">reports<\/a> about the 11,999 BTC moving from PlusToken\u2019s wallet emerged. The money was sitting still since September 21st, 2019.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8 \ud83d\udea8  11,999 <a href=\"https:\/\/twitter.com\/hashtag\/BTC?src=hash&amp;ref_src=twsrc%5Etfw\">#BTC<\/a> (117,393,202 USD) transferred from unknown wallet to unknown wallet<\/p>\n<p>Tx: <a href=\"https:\/\/t.co\/yQfrFxNRs1\">https:\/\/t.co\/yQfrFxNRs1<\/a><\/p>\n<p>&mdash; Whale Alert (@whale_alert) <a href=\"https:\/\/twitter.com\/whale_alert\/status\/1227159227426275329?ref_src=twsrc%5Etfw\">February 11, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to ErgoBTC, the original wallet was a part of the PlusToken cluster and has been marked by all blockchain analysis tools.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/cc35cf39-742d-480d-901e-6d67b7604878-e1583836116580.jpeg\" alt=\"Balance dynamics for the original wallet\" width=\"820\" height=\"405\" \/><\/p>\n<p><i>Balance dynamics for the original wallet<\/i><i>. Source: <\/i><a href=\"https:\/\/bitaps.com\/c9e9649d315660cc9f2f10b335ed77863f96e4d01022fbbeac5d9a76c19ef224\"><i>Bitaps<\/i><\/a><\/p>\n<p>Then, the money moved again, catching the eye of Chiachih Wu, the vice-president of a blockchain-security firm PeckShields, and the rest of the community. Yet, the attention of the public didn\u2019t last long. Primarily, the situation was being monitored by researchers and a small audience on social networks.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"und\" dir=\"ltr\">New <a href=\"https:\/\/twitter.com\/hashtag\/PLUSTOKEN?src=hash&amp;ref_src=twsrc%5Etfw\">#PLUSTOKEN<\/a> parking addresses:<\/p>\n<p>19bMszbozeHyjANgSyM9iyjsZU1sKsR6uM (11,999 <a href=\"https:\/\/twitter.com\/hashtag\/BTC?src=hash&amp;ref_src=twsrc%5Etfw\">#BTC<\/a>)<br \/>1LT4ae84S8tCsZtrLCcz3Z38DGn1LnZ9op (424 <a href=\"https:\/\/twitter.com\/hashtag\/BTC?src=hash&amp;ref_src=twsrc%5Etfw\">#BTC<\/a>) <a href=\"https:\/\/t.co\/8xLJ5OXM39\">pic.twitter.com\/8xLJ5OXM39<\/a><\/p>\n<p>&mdash; cwu.eth (@chiachih_wu) <a href=\"https:\/\/twitter.com\/chiachih_wu\/status\/1227155404171296768?ref_src=twsrc%5Etfw\">February 11, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Before mixing, the coins were split into small parts on different addresses, as mixing a large sum is difficult. The people behind these transactions were probably using wallets with built-in mixers and their respective liquidity pools. In order to launder this much money, such wallets don\u2019t have sufficient liquidity, but the \u201csplit and mix\u201d approach turned out to be effective.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Leaning towards mixer deposit pre-split.<\/p>\n<p>If these are mixer deposits will see how long it takes for coins to start coming out the other side. <a href=\"https:\/\/t.co\/FyddM5XaFS\">https:\/\/t.co\/FyddM5XaFS<\/a><\/p>\n<p>&mdash; \u2234FreeSamourai\u2234 (@ErgoBTC) <a href=\"https:\/\/twitter.com\/ErgoBTC\/status\/1227312091813556232?ref_src=twsrc%5Etfw\">February 11, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Notably, centralized exchanges use special tools to assign Risk Score to transactions. This score allows exchanges to see if the transaction is \u201cclean\u201d or \u201cdirty.\u201d If assets move from an address flagged as \u201cdirty,\u201d all the receiving addresses together with the original \u201cdirty\u201d are grouped into the same cluster. But it doesn\u2019t happen instantaneously. Criminals have a small gap, during which they can mix and sell the coins before the platform notices. Since exchanges are typically interested in higher trading volumes, they often do nothing if the transaction isn\u2019t flagged.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/cdca67f2-17b0-43ac-b341-1b625b494a71-e1583835858880.jpeg\" alt=\"The start of mixing\" width=\"820\" height=\"334\" \/><\/p>\n<p><i>The start of mixing. Source: KYCP<\/i><\/p>\n<p>In the case of the PlusToken cluster, the whole sum was split into batches of 1\u20135 BTC. Using KYCP, I\u2019ve managed to track the output branches. After mixing, the coins were accumulated in groups of 300\u2013400 BTC. For all instances, the algorithm was the same, which suggests there was a single owner.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/5360321a-4f01-4303-b7b0-3c5e7347c31c-e1583835655201.jpeg\" alt=\"One of the output transaction branches, which can be considered the end of mixing the 11,999 BTC\" width=\"820\" height=\"403\" \/><\/p>\n<p><i>One of the output transaction branches, which can be considered the end of mixing the 11,999 BTC. Source: <\/i><a href=\"https:\/\/www.kycp.org\/#\/c08c9ea6858cf4d0af68c611edc2e0962470013029cf0105b95b400d1993c3b8\"><i>KYCP<\/i><\/a><\/p>\n<p>The coins aggregated into large sums were then sent to exchanges. KYCP <a href=\"https:\/\/www.kycp.org\/#\/2575d478e09be3e336a133a90a046a110055ac1bd4cd2167f8ebc0565c10df48\">shows<\/a> how PlusToken\u2019s coins were getting to OKEx exchange in groups of 20\u201350 BTC. For this particular case, the last batch of 55 BTC <a href=\"https:\/\/www.kycp.org\/#\/2575d478e09be3e336a133a90a046a110055ac1bd4cd2167f8ebc0565c10df48\">was sent<\/a> to the exchange on February 28th.<\/p>\n<p>According to ErgoBTC, 50% of all the assets being moved by PlusToken went through OKEx. Meanwhile, Huobi exchange got only 25% directly and 45% indirectly. This means that the share of other exchanges amounted to about 5%.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">For February, Huobi directly received roughly ~25% and indirectly closer to 45%.<\/p>\n<p>The remaining ~5% goes to &quot;others&quot;.<\/p>\n<p>My point: Recently, most of these coins are going to or through regulated KYC&#39;d exchanges, not &quot;OTC&quot;.<\/p>\n<p>&mdash; \u2234FreeSamourai\u2234 (@ErgoBTC) <a href=\"https:\/\/twitter.com\/ErgoBTC\/status\/1229106184214503426?ref_src=twsrc%5Etfw\">February 16, 2020<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h2>Unsettling Conclusion<\/h2>\n<p>Despite the attention from the crypto-community and media, PlusToken\u2019s 11,999 BTC were transferred to exchanges to be sold. The reasons behind this include the insufficiently fast risk calculation procedures and trading platforms\u2019 negligence regarding incoming transactions.<\/p>\n<p>Notably, the mechanism utilized to transfer the money to OKEx <a href=\"https:\/\/www.kycp.org\/#\/c693a620024b7e6bcc79bf805570b93e286b1e390b627a43d84d4f106b1c2a95\">shows<\/a> how the platform acted as a mixing service, adding \u201cgrey\u201d inputs to normal transactions.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/Snimok-ekrana-2020-03-10-v-12.17.03-e1583835490782.png\" alt=\"OKEx transactions\" width=\"820\" height=\"440\" \/><\/p>\n<p><i>OKEx transactions. Source: KYCP<\/i><\/p>\n<p>The movements of the BTC in question seen in February and the Bitcoin price dynamics suggest that the sale of these coins did, in fact, push the market down.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/Snimok-ekrana-2020-03-10-v-12.31.31-e1583836336742.png\" alt=\"BTC\/USD chart\" width=\"820\" height=\"572\" \/><\/p>\n<p><i>BTC\/USD chart. Source: <\/i><a href=\"https:\/\/www.tradingview.com\/chart\/?symbol=GEMINI%3ABTCUSD\"><i>TradingView<\/i><\/a><\/p>\n<p>Back in summer 2019, scammers <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2019-12-16\/chinese-crypto-scam-unwind-suggests-bitcoin-risks-extending-drop\">have hindered<\/a> Bitcoin price growth. Now we have a seemingly similar scenario.<\/p>\n<p>By mixing the coins from PlustToken the exchanges involved have created a precedent. Now there\u2019s no sense in categorizing the scammer\u2019s BTC into \u201cclean\u201d and \u201cdirty,\u201d everything has been laundered.<\/p>\n<h3><b><i>Disclaimer<\/i><\/b><\/h3>\n<p><i>The views expressed in this article are those of the author and don\u2019t necessarily represent the opinions of the editorial board.<\/i><\/p>\n<p><b>Follow us on <\/b><a href=\"https:\/\/twitter.com\/forklogmedia\"><b>Twitter<\/b><\/a><b> and <\/b><a href=\"https:\/\/www.facebook.com\/forklogmedia\"><b>Facebook<\/b><\/a><b> and join our <\/b><a href=\"https:\/\/t.me\/forklogmedia\"><b>Telegram channel<\/b><\/a><b> to know what\u2019s up with crypto and why it\u2019s important.<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Chinese pyramid scheme called PlusToken has managed to gain notoriety as a significant factor influencing Bitcoin\u2019s price. Just recently, a hefty bunch of 11,999 BTC from its wallet started moving, putting the watchful members of the community on high alert: an en masse sell-off of this much Bitcoin wouldn\u2019t be a good thing for [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":8394,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"human_written","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[798],"tags":[18,480,549],"class_list":["post-8392","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-investigations","tag-bitcoin","tag-bitcoin-price","tag-scam"],"aioseo_notices":[],"amp_enabled":true,"views":"517","promo_type":"1","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/8392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=8392"}],"version-history":[{"count":2,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/8392\/revisions"}],"predecessor-version":[{"id":8396,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/8392\/revisions\/8396"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/8394"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=8392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=8392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=8392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}